2024 CVEs (page 29)
Page 29 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38657 | Medium | 4.9 | 2025-02-21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2024-54756 | Critical | 9.8 | 2025-02-20 | A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a cra… |
CVE-2024-7141 | | 2025-02-20 | Versions of Gliffy Online prior to versions 4.14.0-7 contains a Cross Site Request Forgery (CSRF) flaw. | |
CVE-2024-55457 | Medium | 6.5 | 2025-02-20 | MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the fi… |
CVE-2024-54961 | Medium | 6.5 | 2025-02-20 | Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and emai… |
CVE-2024-54960 | Medium | 6.5 | 2025-02-20 | A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. |
CVE-2024-54959 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS… |
CVE-2024-54958 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious sc… |
CVE-2024-46933 | High | 7.7 | 2025-02-20 | An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shipped without proper ha… |
CVE-2024-57716 | High | 7.5 | 2025-02-20 | An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function. |
CVE-2024-57401 | Critical | 9.8 | 2025-02-20 | SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Password function. |
CVE-2024-49781 | High | 7.1 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2024-49779 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to bypass security restrictions, caused by improper validation and manageme… |
CVE-2024-49344 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages with Watson Assistant chat feature enabled the application establishes a session when a user logs in an… |
CVE-2024-49337 | Medium | 5.4 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields… |
CVE-2024-6432 | Medium | 6.4 | 2025-02-20 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's short… |
CVE-2024-13855 | Medium | 4.3 | 2025-02-20 | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_g… |
CVE-2024-13849 | Medium | 5.5 | 2025-02-20 | The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0 due to insufficient input s… |
CVE-2024-13802 | Medium | 6.4 | 2025-02-20 | The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to… |
CVE-2024-13792 | High | 7.3 | 2025-02-20 | The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13789 | Critical | 9.8 | 2025-02-20 | The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from t… |
CVE-2024-13753 | High | 8.1 | 2025-02-20 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to mis… |
CVE-2024-13748 | Medium | 4.4 | 2025-02-20 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including… |
CVE-2024-13520 | Medium | 5.3 | 2025-02-20 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to… |
CVE-2024-13476 | High | 7.5 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions… |
CVE-2024-13888 | High | 7.2 | 2025-02-20 | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the… |
CVE-2024-13155 | Medium | 6.4 | 2025-02-20 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all ve… |
CVE-2024-13445 | Medium | 6.4 | 2025-02-20 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap… |
CVE-2024-49782 | Medium | 6.8 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit th… |
CVE-2024-49780 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform… |
CVE-2024-49355 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. |
CVE-2024-43196 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to… |
CVE-2024-6697 | Medium | 6.5 | 2025-02-20 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions… |
CVE-2024-6696 | Medium | 4.9 | 2025-02-20 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sy… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho… |
CVE-2024-37362 | Medium | 6.3 | 2025-02-20 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (… |
CVE-2024-37361 | Critical | 9.9 | 2025-02-20 | The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Bus… |
CVE-2024-12284 | High | 8.8 | 2025-02-20 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. |
CVE-2024-5706 | High | 8.8 | 2025-02-19 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a res… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2024-37360 | Medium | 4.4 | 2025-02-19 | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software… |
CVE-2024-37359 | High | 8.6 | 2025-02-19 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that th… |
CVE-2024-53974 | Medium | 5.4 | 2025-02-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-45777 | Medium | 6.7 | 2025-02-19 | A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, lead… |
CVE-2024-52541 | High | 8.2 | 2025-02-19 | Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerabili… |
CVE-2024-45084 | High | 8.0 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker cou… |
CVE-2024-45081 | Medium | 6.5 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect a… |
CVE-2024-28780 | Medium | 5.9 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow… |
CVE-2024-28777 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to… |
CVE-2024-28776 | Medium | 5.4 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2024-52902 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could… |
CVE-2024-13534 | High | 7.5 | 2025-02-19 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in… |
CVE-2024-13533 | High | 7.5 | 2025-02-19 | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1… |
CVE-2024-13491 | High | 7.5 | 2025-02-19 | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in al… |
CVE-2024-13485 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ver… |
CVE-2024-13483 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions u… |
CVE-2024-13481 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13479 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions u… |
CVE-2024-13478 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2024-13489 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13364 | Medium | 5.3 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset()… |
CVE-2024-13363 | Medium | 6.1 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to… |
CVE-2024-13339 | Medium | 6.1 | 2025-02-19 | The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. This is due to missi… |
CVE-2024-13336 | Medium | 4.3 | 2025-02-19 | The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or… |
CVE-2024-13231 | Medium | 5.3 | 2025-02-19 | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-13854 | Medium | 4.3 | 2025-02-19 | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the na… |
CVE-2024-13736 | Medium | 6.1 | 2025-02-19 | The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up t… |
CVE-2024-13719 | Medium | 5.3 | 2025-02-19 | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoic… |
CVE-2024-13712 | Medium | 4.9 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient es… |
CVE-2024-13711 | Medium | 6.1 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due t… |
CVE-2024-13679 | Medium | 6.4 | 2025-02-19 | The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and incl… |
CVE-2024-13676 | Medium | 6.5 | 2025-02-19 | The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions u… |
CVE-2024-13674 | Medium | 6.4 | 2025-02-19 | The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwp_social_share'… |
CVE-2024-13663 | Medium | 6.4 | 2025-02-19 | The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and inc… |
CVE-2024-13660 | Medium | 6.4 | 2025-02-19 | The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fshow' shortcode in all versions up to, and… |
CVE-2024-13657 | Medium | 6.4 | 2025-02-19 | The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up t… |
CVE-2024-13592 | High | 7.5 | 2025-02-19 | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2024-13591 | Medium | 6.4 | 2025-02-19 | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-b… |
CVE-2024-13589 | Medium | 6.4 | 2025-02-19 | The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yt_grid' shortcode in all versions up to… |
CVE-2024-13468 | High | 7.5 | 2025-02-19 | The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-actio… |
CVE-2024-13462 | Medium | 6.4 | 2025-02-19 | The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2… |
CVE-2024-13405 | Medium | 4.3 | 2025-02-19 | The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missin… |
CVE-2024-13390 | Medium | 6.4 | 2025-02-19 | The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfo_list' shortcode in all versi… |
CVE-2024-12522 | Medium | 6.4 | 2025-02-19 | The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms'… |
CVE-2024-12339 | Medium | 6.1 | 2025-02-19 | The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘channel' parameter in all versions up to, and including… |
CVE-2024-12069 | Medium | 6.1 | 2025-02-19 | The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-11778 | Medium | 6.4 | 2025-02-19 | The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode in all versions… |
CVE-2024-11753 | Medium | 6.4 | 2025-02-19 | The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umich_oidc_button' shortcode in all versions up to, an… |
CVE-2024-11335 | Medium | 6.4 | 2025-02-19 | The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… |
CVE-2024-13799 | Medium | 6.4 | 2025-02-19 | The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new… |
CVE-2024-12173 | Low | 3.5 | 2025-02-19 | The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and… |
CVE-2024-13443 | Medium | 6.4 | 2025-02-19 | The Easypromos Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Easypromos shortcode in all versions up to, and includ… |
CVE-2024-11582 | High | 7.2 | 2025-02-19 | The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions u… |
CVE-2024-57262 | High | 7.1 | 2025-02-19 | In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inod… |
CVE-2024-57261 | High | 7.1 | 2025-02-19 | In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258. |
CVE-2024-13508 | Medium | 6.1 | 2025-02-19 | The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72… |
CVE-2024-57259 | High | 7.1 | 2025-02-18 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the p… |
CVE-2024-57258 | High | 7.1 | 2025-02-18 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_… |
CVE-2024-57257 | Low | 2.0 | 2025-02-18 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. |
CVE-2024-57256 | High | 7.1 | 2025-02-18 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem wi… |